Univention Keycloak app documentation

• 1. Introduction
• 2. Installation
  • 2.1. Installation with the web browser
  • 2.2. Installation with command-line
  • 2.3. Initial Keycloak configuration
  • 2.4. Sign in to Keycloak Admin Console
  • 2.5. Fetch metadata for service provider configuration
• 3. Update
  • 3.1. Configuration migration during Keycloak app updates
• 4. Configuration
  • 4.1. Use Keycloak for login to Univention Portal
  • 4.2. Import of user attributes from UCS to Keycloak
  • 4.3. Keycloak as OpenID Connect provider
  • 4.4. Keycloak as SAML Identity Provider
  • 4.5. Backup and restore
  • 4.6. Multiple installations in the domain
  • 4.7. Two-factor authentication for Keycloak
    • 4.7.1. Activate two-factor authentication for domain administrators
    • 4.7.2. Deactivate two-factor authentication for domain administrators
  • 4.8. Settings
  • 4.9. Customize the appearance
    • 4.9.1. Adjusting texts on the Keycloak login page
    • 4.9.2. Additional links on the login page
    • 4.9.3. Cookie consent banner dialog
  • 4.10. Customize web server configuration for Keycloak
  • 4.11. Activate Kerberos authentication
  • 4.12. Restrict Kerberos authentication to IP subnets
    • 4.12.1. Assign authentication flow
  • 4.13. Restrict access to applications
    • 4.13.1. Create authentication flow
    • 4.13.2. Assign authentication flow
    • 4.13.3. Map UDM groups to Keycloak
    • 4.13.4. Create Keycloak client roles
    • 4.13.5. Attach the client specific role to groups
    • 4.13.6. Customize the authorization error page
  • 4.14. Import additional CA certificates
• 5. Database configuration
  • 5.1. Default database
  • 5.2. Custom database
  • 5.3. Changing the database configuration
    • 5.3.1. Initial installation
    • 5.3.2. After initial installation
• 6. Architecture
  • 6.1. Overview
  • 6.2. Design decisions
• 7. Requirements and limitations
  • 7.1. User federation and synchronization
  • 7.2. Installation on UCS
  • 7.3. No user activation for SAML
  • 7.4. Password restriction
  • 7.5. Application clients
• 8. Use cases
  • 8.1. Expired password and change password on next sign-in
  • 8.2. Single sign-on through external public domain name
    • 8.2.1. External FQDN different from internal UCS name
    • 8.2.2. External FQDN identical to internal UCS name
    • 8.2.3. Official (Let's Encrypt) certificates for single sign-on
• 9. Troubleshooting
  • 9.1. SAML assertion lifetime
  • 9.2. Log files
  • 9.3. Debugging
  • 9.4. Configuration of single sign-on through external public domain
    • 9.4.1. Univention Management Console join script failure
    • 9.4.2. Single sign-on session not refreshed

• Changelog
• Bibliography